boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Monday, October 5, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2024-9675

CVE-2024-9675MEDIUM
Buildah: buildah allows arbitrary directory mount
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  L  L  N    4.4   .0039   31.0     —
AFFECTED
  Product                                                                Versions     Fixed
  buildah                                                                unspecified  —
  Red Hat Enterprise Linux 8                                             unspecified  8100020241023085649.afee755d
  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support  unspecified  8060020241028154646.3b538bd8
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service         unspecified  8060020241028154646.3b538bd8
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions         unspecified  8060020241028154646.3b538bd8
  Red Hat Enterprise Linux 8.8 Extended Update Support                   unspecified  8080020241025064551.0f77c1b7
  Red Hat Enterprise Linux 9                                             unspecified  2:1.33.10-1.el9_4
  Red Hat Enterprise Linux 9                                             unspecified  4:4.9.4-16.el9_4
  Red Hat Enterprise Linux 9                                             unspecified  4:5.2.2-9.el9_5
  Red Hat Enterprise Linux 9                                             unspecified  2:1.37.5-1.el9_5
  + 35 more
TIMELINE
  Oct 9   Reserved by redhat
  Oct 9   Published (CNA: redhat)
  Aug 7   RESCORED — CVE-2024-9675 (buildah). CVSS 7.8 → 4.4 (NVD).
CWE-22 · CNA: redhat · CVSS v3.1 · 26 references · NVD status: Modified

Description

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
October 9, 2024ReservedReserved by redhat
October 9, 2024PublishedPublished (CNA: redhat)
August 7, 2026RESCOREDRESCORED — CVE-2024-9675 (buildah). CVSS 7.8 → 4.4 (NVD).

Affected

Affected products and packages — 45 rows
VendorProduct / PackageEcosystemVersion introducedFixed
—buildah———
Red HatRed Hat Enterprise Linux 8——8100020241023085649.afee755d
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support——8060020241028154646.3b538bd8
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service——8060020241028154646.3b538bd8
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions——8060020241028154646.3b538bd8
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support——8080020241025064551.0f77c1b7
Red HatRed Hat Enterprise Linux 9——2:1.33.10-1.el9_4
Red HatRed Hat Enterprise Linux 9——4:4.9.4-16.el9_4
Red HatRed Hat Enterprise Linux 9——4:5.2.2-9.el9_5
Red HatRed Hat Enterprise Linux 9——2:1.37.5-1.el9_5
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support——1:1.26.8-2.el9_0
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support——2:4.2.0-5.el9_0.2
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support——1:1.29.4-1.el9_2
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support——2:4.4.1-21.el9_2
Red HatRed Hat OpenShift Container Platform 4.12——v4.12.0-202503181728.p0.ge355452.assembly.stream.el8
Red HatRed Hat OpenShift Container Platform 4.13——3:4.4.1-15.rhaos4.13.el8
Red HatRed Hat OpenShift Container Platform 4.13——v4.13.0-202503111300.p0.gb379980.assembly.stream.el8
Red HatRed Hat OpenShift Container Platform 4.14——3:4.4.1-21.rhaos4.14.el8
Red HatRed Hat OpenShift Container Platform 4.14——v4.14.0-202503060906.p0.gb03f3f5.assembly.stream.el8
Red HatRed Hat OpenShift Container Platform 4.15——3:4.4.1-32.rhaos4.15.el8
Red HatRed Hat OpenShift Container Platform 4.15——v4.15.0-202503060734.p0.gbc0b789.assembly.stream.el8
Red HatRed Hat OpenShift Container Platform 4.16——4:4.9.4-12.rhaos4.16.el8
Red HatRed Hat OpenShift Container Platform 4.16——v4.16.0-202503121138.p0.g31c3c26.assembly.stream.el9
Red HatRed Hat OpenShift Container Platform 4.17——5:5.2.2-1.rhaos4.17.el8
Red HatRed Hat OpenShift Container Platform 4.17——v4.17.0-202503041005.p0.gc3b0999.assembly.stream.el9
Red HatRed Hat OpenShift Container Platform 4.18——v4.18.0-202503040802.p0.g6a5ec2a.assembly.stream.el9
Red HatRed Hat Quay 3——v3.13.2-1
Red HatRed Hat Quay 3——v3.13.2-2
Red HatRed Hat Quay 3——v3.13.2-1
Red HatRed Hat Quay 3——v3.13.2-2
Red HatRed Hat Quay 3——v3.13.2-4
Red HatRed Hat Quay 3——v3.13.2-1
Red HatRed Hat Quay 3——v3.13.2-1
Red HatRed Hat Quay 3——v3.13.2-10
Red HatRed Hat Quay 3——v3.13.2-1
Red HatRed Hat Quay 3——v3.13.2-11
Red HatOpenShift Developer Tools and Services———
Red HatOpenShift Developer Tools and Services———
Red HatRed Hat Enterprise Linux 10———
Red HatRed Hat Enterprise Linux 10———
Red HatRed Hat Enterprise Linux 7———
Red HatRed Hat Enterprise Linux 9———
Red HatRed Hat OpenShift Container Platform 4———
Red HatRed Hat OpenShift Container Platform 4———
Red HatRed Hat OpenShift Container Platform 4———

Weaknesses

CWE-22

References (26)

Related

Authoritative record: CVE-2024-9675 at cve.org

Vendors: red hat

Weaknesses: CWE-22

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-9675 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 5, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.